POPIA and PAIA Compliance – Document Factory

Document Factory Digital Marketplace

REGISTRATION NUMBER 2021/943411/07 (Document Factory Group Pty Ltd) THE PROMOTION OF ACCESS TO INFORMATION MANUAL (“PAIA Manual”)

Disclaimer: The contents of this document should only be used for and by Document Factory and may not be distributed unlawfully. Older versions are not deemed official. Only the latest version is acceptable.

Effective date: 01 March 2025 | PAIA Manual – Page 1 of 28 Version 2025.01 | Data Classification: Public

1. PREAMBLE

The Promotion of Access to Information Act, 2000 (“PAIA”) came into operation on 9 March 2001. PAIA seeks, among other things, to give effect to the Constitutional right of access to any information held by the State or by any other person where such information is required for the exercise or protection of any right and gives natural and juristic persons the right of access to records held by either a private or public body, subject to certain limitations, in order to enable them to exercise or protect their rights. Where a request is made in terms of PAIA to a private body, that private body must disclose the information if the requester is able to show that the record is required for the exercise or protection of any rights, and provided that no grounds of refusal contained in PAIA are applicable. PAIA sets out the requisite procedural issues attached to information requests.

Section 51 of PAIA obliges private bodies to compile a manual to enable a person to obtain access to information held by such a private body and stipulates the minimum requirements that the manual has to comply with.

This Manual constitutes Document Factory’s PAIA manual. This Manual is compiled in accordance with section 51 of PAIA as amended by the Protection of Personal Information Act, 2013 (“POPIA”), which gives effect to everyone’s Constitutional right to privacy. POPIA promotes the protection of personal information processed by public and private bodies, including certain conditions so as to establish minimum requirements for the processing of personal information. POPIA amends certain provisions of PAIA, balancing the need for access to information against the need to ensure the protection of personal information by providing for the establishment of an Information Regulator to exercise certain powers and perform certain duties and functions in terms of POPIA and PAIA, providing for the issuing of codes of conduct and providing for the rights of persons regarding unsolicited electronic communications and automated decision making in order to regulate the flow of personal information and to provide for matters concerned therewith.

This PAIA manual also includes information on the submission of objections to the processing of personal information and requests to delete or destroy personal information or records thereof in terms of POPIA.

2. ABOUT DOCUMENT FACTORY

Document Factory is an online digital products marketplace that facilitates the transaction between vendors (sellers) and buyers of digital content. The Company operates as an intermediary, retaining a commission of 15% from every successful sale processed through the platform.

3. CONTACT DETAILS

Name of Private Body: Document Factory
Designated Information Officer: Scott Williams
Email address of Information Officer: compliance@documentfactory.co.za
Call Centre number: 0872652892
Postal address: 1220 Wekker Rd, Moreleta Park, Pretoria, 0044
Street address: 1220 Wekker Rd, Moreleta Park, Pretoria, 0044

4. INFORMATION REGULATORS GUIDE

An official Guide has been compiled which contains information to assist a person wishing to exercise a right of access to information in terms of PAIA and POPIA. This Guide is made available by the Information Regulator (established in terms of POPIA). Copies of the updated Guide are available from the Information Regulator free of charge. Any request for public inspection of the Guide at the office of the Information Officer or a request for a copy of the Guide from the Information Officer must substantially correspond with Form 1 of Annexure A to Government Notice No. R.757 dated 27 August 2021 promulgated under the PAIA Regulations. Please refer to Annexure C.

5. OBJECTIVES OF THIS MANUAL

The objectives of this Manual are:

to provide a list of all records held by the legal entity;
to set out the requirements with regard to who may request information in terms of PAIA as well as the grounds on which a request may be denied;
to define the manner and form in which a request for information must be submitted; and
to comply with the additional requirements imposed by POPIA.

6. ENTRY POINT FOR REQUESTS

PAIA provides that a person may only make a request for information, if the information is required for the exercise or protection of a legitimate right.

Information will therefore not be furnished unless a person provides sufficient particulars to enable Document Factory to identify the right that the requester is seeking to protect as well as an explanation as to why the requested information is required for the exercise or protection of that right. The exercise of an individual’s rights is subject to justifiable limitations, including the reasonable protection of privacy, commercial confidentiality and effective, efficient and good governance. PAIA and the request procedure contained in this Manual may not be used for access to a record for criminal or civil proceedings, nor should information be requested after the commencement of such proceedings.

The Information Officer (Scott Williams) has been delegated with the task of receiving and co-ordinating all requests for access to records in terms of PAIA, in order to ensure proper compliance with PAIA and POPIA.

The Information Officer will facilitate the liaison with the internal legal team on all of these requests.

All requests in terms of PAIA and this Manual must be addressed to the Information Officer using the details in paragraph 3 above.

7. AUTOMATICALLY AVAILABLE INFORMATION

Information that is obtainable via the Document Factory website is automatically available and need not be formally requested in terms of this Manual.

The following categories of records are automatically available for inspection, purchase or photocopying:

Platform Terms of Service
Vendor Guidelines
Public press releases
Promotional and marketing material regarding digital listings.

8. INFORMATION AVAILABLE IN TERMS OF POPIA

In terms of POPIA, personal information must be processed for a specified purpose. The purpose for which data is processed by Document Factory will depend on the nature of the data and the particular data subject. This purpose is ordinarily disclosed, explicitly or implicitly, at the time the data is collected.

8.1. Categories of data subjects and personal information collected by Document Factory

Employees:

Name and contact details; Identity number; Employment history; Banking and financial details; Employment contracts; Performance appraisals; Training records; Marital status; Tax information.

Vendors (Sellers):

Business/Personal name; Bank account details for commission payouts; Email address; Identity/Passport number; Product metadata; Sales history; Tax/VAT registration (where applicable).

Consumers (Buyers):

Name; Email address; Purchase history; Payment metadata (via third-party gateways); Billing address; IP addresses and browsing habits on the marketplace.

General Third Parties:

Name and contact details of service providers/contractors.

8.2. The purpose of processing personal information

For Vendors: Facilitating marketplace listings; calculating and deducting 15% commission; processing payouts; managing vendor-buyer disputes.
For Consumers: Managing digital downloads; providing access to purchased content; processing transactions via payment gateways; customer support.
For Employees: Payroll; tax compliance (SARS); recruitment; internal administration.
General: Legal compliance; direct marketing (subject to consent); platform security and fraud prevention.

8.3. The recipients or categories of recipients to whom the personal information may be supplied

Third-party payment processors;
Cloud storage and server hosting providers;
Regulatory and tax authorities (SARS);
Auditors and legal advisors;
Buyers/Vendors (only to the extent necessary to fulfill a digital transaction).

8.4. Planned transborder flows of personal information

Electronic storage on international cloud servers;
Use of international email and payment processing platforms.

8.5. General description of information security measures

Document Factory implements technical and organisational measures including encryption, firewalls, and access controls to ensure the confidentiality and integrity of digital product data and personal information.

9. INFORMATION AVAILABLE IN TERMS OF OTHER LEGISLATION

Information is available in terms of provisions of the following legislation:

Companies Act 71 of 2008
Electronic Communications and Transactions Act 25 of 2002
Value Added Tax Act 89 of 1991
Consumer Protection Act 68 of 2008
Protection of Personal Information Act 4 of 2013
Income Tax Act 58 of 1962

10. CATEGORIES OF RECORDS AVAILABLE UPON REQUEST

Category	Records
Internal records	Incorporation documents; Financial records (commission tracking); Operational records; Marketplace policies.
Personnel records	Employee contracts; internal evaluation records; payroll data.
Vendor/Client records	Vendor agreements; Buyer purchase records; digital transaction logs.
Third party records	Service level agreements; records held by the Company pertaining to contractors.

11. REQUEST PROCEDURE

11.1. Completion of the prescribed form

11.1.1. Requests must correspond with Form 2 (Annexure A). 11.1.6. Objections to processing use Annexure E. 11.1.7. Correction/deletion requests use Annexure F.

11.2. Proof of identity

Acceptable proof of identity (e.g., certified copy of ID) is required.

11.3. Payment of the prescribed fees

11.3.1. Request fee: R140.00. Access fee: Calculated per Annexure B/D based on time and reproduction.

11.4. Timelines for consideration of a request for access

11.4.1. Processed within 30 days (unless extended with notice).

11.5. Grounds for refusal

Access may be refused to protect third-party privacy, commercial trade secrets (e.g., proprietary platform algorithms), or if the request is for pending legal proceedings.

12. REMEDIES AVAILABLE TO A REQUESTER ON REFUSAL OF ACCESS

The decision of the Information Officer (Scott Williams) is final. Requesters may apply to a court of competent jurisdiction if unsatisfied.

13. AVAILABILITY OF THIS MANUAL

Copies of this Manual are available at the registered address (1220 Wekker Rd, Pretoria) and at www.documentfactory.co.za.

ANNEXURE A (FORM 2) REQUEST FOR ACCESS TO RECORD (Includes all required regulatory fields for Personal Information, Record Particulars, and Preferred Manner of Access.)